[BUG] 8379675: test/jdk/sun/security/pkcs11/rsa/GenKeyStore.java uses removed methods

Overview#

GenKeyStore.java is a helper program for regenerating the RSA test keystore. Although it does not run during normal test execution, it is placed in the test tree to allow regeneration of rsakeys.ks when needed.

Previously, the certificate generation process in this file explicitly set an AlgorithmId on X509CertInfo, and then called X509CertImpl#sign(...). However, using this approach would involve invoking a deprecated API, so it was replaced with X509CertImpl.newSigned(...)¹.

After the change, setting the AlgorithmId and calling sign(...) are handled by newSigned(...). As a result, while the certificate generation process remains the same, redundant steps have been eliminated.

-        AlgorithmId algID = AlgorithmId.getAlgorithmId(algorithm);
-
         X509CertInfo certInfo = new X509CertInfo();
-        certInfo.set(X509CertInfo.ALGORITHM_ID, new CertificateAlgorithmId(algID));
         ...
-        X509CertImpl cert = new X509CertImpl(certInfo);
-        cert.sign(privateKey, algorithm);
-
-        return cert;
+        return X509CertImpl.newSigned(certInfo, privateKey, algorithm);

Additionally, where X509CertInfo#set(...) was used to pass field names, it has been replaced with specialized methods such as setVersion(...) and setSerialNumber(...). This change is not intended to alter functionality².

2026/04/04 Discovered in JBS#

This issue was discovered on JBS, where the certificate generation process of GenKeyStore.java was reviewed. The title of the JBS ticket mentions test/jdk/sun/security/pkcs11/rsa/GenKeyStore.java, but the actual file modified is test/jdk/sun/security/rsa/GenKeyStore.java¹.

In the PR, the main goal was to avoid using deprecated methods. As a result, explicit setting of AlgorithmId and calling sign(...) were removed².

2026/04/04 Review Follow-up#

Weijun Wang³ commented that the changes themselves are fine. Additionally, it was suggested to retain comments about the current execution method since this program was written before module introduction, to wrap long signatures in getCertificate(...), and to update the copyright year to 2026.

In response, I added the following example of how to run the file near the top:

java --add-exports java.base/sun.security.x509=ALL-UNNAMED GenKeyStore.java

2026/04/05 Review#

Mr. Wang³ approved the changes and performed /integrate.

2026/04/06 Integration#

He then sponsored the change, which was integrated into JDK as commit 1d29010⁴.

Overview#

2026/04/04 Discovered in JBS#

2026/04/04 Review Follow-up#

2026/04/05 Review#

2026/04/06 Integration#

Footnotes#